SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsvps-starter

vps-starter

Deployment & operations

View repository

Updated 10-15 10:43

About this skill

vps-starter — VPS beginner onboarding companion

Produced by 43 COLLEGE 凯寓 | v1.0

Positioning

This skill does only one thing: take a person who has never touched a server from "receiving the VPS account email" to "having a clean, secure, always-available Linux server".

Does not teach specific applications (installing a VPN, building a blog, running Docker); those are for subsequent skills. Here we only lay the foundation.

Things explicitly not done：

  • Does not guide any proxy / VPN circumvention tools (except WireGuard/OpenVPN remote access, but that is handled by a separate skill)
  • Does not buy a VPS on the user's behalf (only teaches the criteria for judging)
  • Does not directly execute high-risk operations (user confirmation is required before changing the SSH port or disabling root login)

Trigger conditions

Triggered when the user says one of these:

  • "I bought a VPS and don't know how to use it"
  • "First time using a server"
  • "How do I log in via SSH"
  • "How do I initialize a server"
  • "vps-starter" / "/vps-starter"

Opening three questions (must ask first, do not skip)

Don't start with a long tutorial. First clarify three things:

1. 你是什么电脑？Mac 还是 Windows？(决定用什么工具 SSH)
2. VPS 买了吗？买的哪家、哪个套餐、装的什么系统？
   - 如果没买：转入"选 VPS"环节（第 1 步）
   - 如果买了但不知道装的啥系统：让他登后台看
   - **系统必须是 Ubuntu 或 Debian**。如果是 CentOS / AlmaLinux / Rocky 等 RHEL 系，命令完全不同，这个 skill 不覆盖——让用户去服务商后台重装成 **Ubuntu 24.04 LTS** 或 **Debian 12** 再回来
3. VPS 服务商给你的邮件里，有没有这四样东西？
   - 服务器 IP（形如 1.2.3.4）
   - SSH 端口（通常 22。**如果不是 22**，记下这个数字——后面所有 `ssh` 命令要带 `-p 端口号`，AI 会帮你加）
   - 用户名（通常 root）
   - 密码
   有 → 进第 2 步
   缺 → 去服务商后台找，或让客服重置密码

Before these three things are aligned, do not go on to explain any commands. Beginners are most likely to make a mistake at the first step, and then everything collapses afterward.

Step 1: Choosing a VPS (when the user hasn't bought one yet)

Tell the user how to judge whether a VPS is sufficient, without recommending specific providers or including affiliate links:

Metric Minimum sufficient for a beginner to get started Explanation
CPU 1 core Enough to run SSH + basic services
Memory 1 GB Any lower and OOM is easy
Disk 20 GB SSD System + logs + a small amount of data
Monthly traffic 500 GB Basically enough for personal use
Bandwidth 100 Mbps+ Below this, downloading new things will be very slow
System Ubuntu 24.04 LTS or Debian 12 The most complete ecosystem and the most tutorials.This skill only covers these two
Location Choose according to purpose Off-site backup/remote desktop → close to yourself; for overseas friends → according to their location

Three criteria for judging whether a provider is reliable：

  1. Whether it has a KVM console (can rescue it if the system installation breaks)
  2. Whether it can reinstall the system (not afraid to experiment and make mistakes)
  3. Refund policy (7-day no-questions-asked is best)

Recommended action: Have the user search "VPS recommendations 2025", "VPS reviews" themselves, look at review articles from the past six months, and don't buy from small vendors whose reviews haven't been updated for more than 2 years.

Step 2: First SSH login

Explain separately across platforms:

Mac users

  1. Open Terminal(focus search "Terminal" or "终端")

  2. Enter (when the port is 22):

    ssh root@你的服务器IP

    Example:ssh root@1.2.3.4

    If the port is not 22 (for example 2222):

    ssh -p 2222 root@你的服务器IP

    subsequentevery ssh-related command must include this -p, the AI will remember it for you

  3. On the first connection, a prompt like this will appear:

    The authenticity of host '1.2.3.4' can't be established.
ED25519 key fingerprint is SHA256:xxxxxxxx...
Are you sure you want to continue connecting (yes/no)?

    This is SSH asking "are you sure this is your server?"—it's used to prevent someone from impersonating your server and intercepting you.This question is asked only once in a lifetime, type yes and press Enter (to be strict, you can verify that SHA256 string in the provider's backend, but beginners don't need to)

  4. You will be asked to enter a password:Nothing will be displayed on the screen while you type (no asterisks, nothing moves), this is normal, type blindly and press Enter

Windows users

Option A: built into the system (available by default on Win10 / Win11)

  1. Press Win + X, select "Windows Terminal" or "PowerShell"
  2. Type ssh root@你的服务器IP, if the port is not 22 add -p 端口号
  3. Same as Mac's yes/no confirmation + blind password entry process

Option B: graphical client (recommended if you're completely unfamiliar with the command line)

  • Recommended Termius(the free version is enough, friendly interface) or MobaXterm(more established)
  • After downloading and installing, create a new Session / Host,fill in respectively IP, port, username, password, and click Connect
  • This type of client lists "port" as a separate field, so you don't have to remember -p
  • You'll hit fewer pitfalls; the downside is that all subsequent commands still have to be typed, it's just that the login interface is more intuitive

Signs of a successful login

The screen will display something like:

Welcome to Ubuntu 22.04.3 LTS (GNU/Linux ...)
Last login: ...
root@主机名:~#

That last prompt ending with # is the you are already inside the server. After that, the commands you enter all run on the server, not on your local computer.

Common errors and fallbacks：

  • Connection refused: the server is not started, or the SSH port is not 22. Go back to the provider's backend and check the console status
  • Connection timed out: the IP is wrong, or the network has a firewall blocking it. First ping IP to see if it's reachable
  • Permission denied: the password is wrong, or the username is incorrect (both root and ubuntu are possible)
  • If you've confirmed the password is correct but still can't get in: go to the provider's backend to reset the root password, then try again

Step 3: System initialization (do immediately after logging in)

Guiding principle: for each command, tell the user "what this is for" and "what you'll normally see"; don't just throw out a string for them to copy.

3.1 Update the system (the first thing to do on any new server)

apt update && apt upgrade -y
  • What it does: brings all system packages up to the latest version and patches known vulnerabilities
  • What you'll see: a bunch of green/white text will scroll by, and finally it returns to the # prompt. If a purple dialog box pops up midway (configuring openssh-server or similar), use the arrow keys to select "keep the local version" and press Enter to continue
  • Time required: 1-5 minutes depending on network speed

3.2 Change the hostname and timezone (optional but recommended)

Change the hostname:

hostnamectl set-hostname 你想起的名字
  • Example:hostnamectl set-hostname my-vps-01
  • Takes effect after you log out and reconnect

Set the timezone (new VPSs default to UTC, which is 8 hours behind Beijing time; if the log times don't match what you see, it will be very uncomfortable):

timedatectl set-timezone Asia/Shanghai
date    # 验证——应该显示当前的北京时间

3.3 Create a regular user (don't always use root)

Before coming up with a username, look at this one: tens of millionsdo not use admin、test、user、ubuntu、www、git、oracle this kind of name—automated scanning scripts blast these names across the entire internet 24/7, which is like walking around naked. Pick a name only you know (not too short, at least 5 letters).

adduser 你的用户名
  • Example:adduser kaiyu
  • It will ask for the new password twice (it is also not displayed while typing, so type blind), then a bunch of information (full name, phone number, etc.)—just press Enter to skip
  • Finally Is the information correct? [Y/n] enter Y

Add sudo privileges:

usermod -aG sudo 你的用户名

Test whether the new user can log in（Do not close that original root window yet, in case the new user cannot log in, root is the only rescue channel):

  • Open a new window：
    • Terminal / PowerShell users: open another new terminal window (Cmd+N / new tab is fine)
    • Termius users:click "New Host" to create a new connection, do not use "Duplicate Session" (that just copies the current session, it is not a real new connection)
  • Enter ssh 你的用户名@服务器IP(for non-22 ports remember to add -p 端口号）
  • yes/no confirmation (the new user is connecting for the first time, so it will ask again, enter yes）
  • Here use the password you set when creating the user just now(the key is not configured yet, so log in with the password for now; the next step 3.4 will configure the key, and after that you will not need the password)
  • After logging in, try: 
    sudo whoami
    Enter the user's password; returning root means sudo privileges are in place
  • Once it succeeds, proceed to 3.4; if it fails, stop and troubleshoot, absolutely do not continue

3.4 Configure SSH key login (strongly recommended, configure once and save effort forever)

On the user's own computer(not the server!) generate the key:

ssh-keygen -t ed25519 -C "你的邮箱或备注"
  • It asks for the file save location: just press Enter to use the default
  • It asks for a passphrase: it can be empty (just press Enter twice), or set a password (more secure but you have to enter it every time)

Where are the key files stored(figure this out first so you do not have to search everywhere):

  • Mac / Linux：~/.ssh/id_ed25519(private key) and ~/.ssh/id_ed25519.pub(public key)
  • Windows：C:\Users\你的用户名\.ssh\id_ed25519 and in the same directory .pub

The private key (the one without the .pub suffix) is equivalent to your ID card, never share it or post it in a group. The public key (ending in.pub ) is the one to give to the server.

Upload the public key to the server：

Mac / Linux users—use the built-in ssh-copy-id：

ssh-copy-id 你的用户名@服务器IP

(non-22 port:ssh-copy-id -p 端口号 你的用户名@服务器IP）

Windows users—the OpenSSH built into PowerShell does not have ssh-copy-id command, use the following instead (copy and paste the whole thing at once, do not split it):

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh 你的用户名@服务器IP "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

(non-22 port: after ssh add -p 端口号, i.e. | ssh -p 端口号 你的用户名@...）

It will ask you to enter the user password once (this is the last time you will log in with a password), then press Enter.

Test: open a new window,ssh 你的用户名@服务器IP，logs in directly without asking for a passwordand it works. If it still asks for a password, it means the public key was not uploaded correctly—stop and troubleshoot, do not continue.

3.5 Harden the SSH configuration (only do this step after finishing 3.4)

Let us state the risk warning clearly first: If you get this step wrong, you'll lock yourself out. Before changing it, you mustAll three must be satisfied：

  • 3.3 The new user created can log in with a password
  • 3.4 Key login can get in directly without entering a password
  • The original root terminal windowDo not close it yet, keep it as a lifeline

If any one of the three is not satisfied, stop and do not continue modifying.

Edit the configuration:

sudo nano /etc/ssh/sshd_config

Find and modify the following lines (the leading # must be removed):

PermitRootLogin no          # 禁止 root 直接登录
PasswordAuthentication no   # 禁止密码登录，只用密钥

Ctrl+O to save, press Enter to confirm, Ctrl+X to exit.

Restart SSH:

sudo systemctl restart ssh

(If it reports Unit ssh.service not found or a similar error, change it to sudo systemctl restart sshd—the service name differs across distributions)

Immediately open a new window to verify（Keep the original root window open）：

  • ssh root@服务器IP should be rejected
  • ssh 你的用户名@服务器IP should get in without a password
  • Only after both are correct can you close the original root window

If you get locked out: Use the provider's backend KVM console (web-based terminal) to log in, change sshd_config back, and restart SSH.

Step 4: Firewall (ufw, applicable to Ubuntu/Debian)

sudo apt install ufw -y
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp        # 放行 SSH，千万别漏
sudo ufw enable              # 启用。会问 y/n，输 y
sudo ufw status              # 看状态，应该列出 22 端口允许

The order is critical: allow 22 first, then enable. Doing it in reverse will cut off SSH itself.

To open new ports later (for example, when installing a service that needs external access):

sudo ufw allow 80/tcp        # HTTP
sudo ufw allow 443/tcp       # HTTPS

Step 5: Handover

At this point, what the user gets is a machine that:

  • System is up to date
  • Has a dedicated regular user (with sudo)
  • root cannot log in remotely
  • Only key-based login is allowed
  • Firewall denies by default, only SSH is open

This is aclean and usable base server. Any subsequent action (installing Docker, building a website, running a VPN, database) should start from this point, not from a bare machine.

Leave the user a few commonly used commands：

df -h            # 看硬盘剩多少
free -h          # 看内存
top              # 看 CPU/进程（按 q 退出）
sudo apt update && sudo apt upgrade -y   # 定期更新，至少每月一次
history          # 看自己之前敲过的命令

Remind the user to keep three things safe：

  1. The provider backend account password (for KVM emergencies)
  2. Local ~/.ssh/id_ed25519(private key; if lost, you can never log in again)
  3. Server IP and username

Behavioral guidelines throughout the whole process

  1. Wait for user feedback before proceeding at every step: Do not dump steps 1-5 all at once and let them go through it alone. After each step, ask "Do you see XX?" and only move to the next step once it matches
  2. Always use placeholders + examples for variables in commands：ssh root@你的服务器IP immediately followed by 例：ssh root@1.2.3.4
  3. Remind them every time a password is entered that "it will not be displayed": Beginners most easily get stuck here
  4. Dangerous operations must be double-confirmed: Before changing sshd_config or enabling ufw, clearly state "what will happen if this step is changed incorrectly"
  5. When an error occurs, have the user paste the original text, do not guess the cause yourself
  6. Do not proactively guide the installation of any proxy/VPN circumvention tools. If the user wants to continue after finishing the basics, guide them to find the corresponding independent skill, or the official documentation